How to Create Cloudflare Turnstile Keys for “CAPTCHA – reCAPTCHA” Module

 1. What is Cloudflare Turnstile?

Cloudflare Turnstile is a free, privacy-friendly alternative to traditional CAPTCHA. Instead of asking users to solve puzzles, Turnstile runs a few background checks in the browser to verify that a visitor is human. It can be used on any website, even if your site is not proxied through Cloudflare.

The “CAPTCHA – reCAPTCHA” module integrates with Cloudflare Turnstile so you can protect your forms (login, registration, contact, etc.) using a Turnstile widget.

To use it, you must create a site key and a secret key in your Cloudflare account.

2. Prerequisites

Before you start, make sure you have:

• A Cloudflare account (free is enough). If you don’t have one, you can sign up at Cloudflare’s website: https://dash.cloudflare.com/sign-up
• Access to the domain where your shop or website is running (for example, `example.com`).
• Access to your shop’s back office to configure the “CAPTCHA – reCAPTCHA” module.

3. Log in to Cloudflare and open Turnstile

Go to the Cloudflare dashboard: https://dash.cloudflare.com/

Log in with your Cloudflare account.

In the sidebar navigation, select "Application Security > Turnstile".

This is where your Turnstile widgets and keys will be managed. 

If this is your first time using Turnstile, the page will be empty and will invite you to create your first widget.

4. Create a new Turnstile widget (generate keys)

Cloudflare uses a widget to generate your site key and secret key. Each widget is associated with one website or usage scenario.

On the Turnstile page, click the "Add Widget" button. You will see a form with several fields. Fill them as follows:

4.1. Basic widget information

Widget name: This is only used inside your Cloudflare dashboard to help you recognize the widget later. Choose a short, clear name that helps you know where this widget is used.

Examples:

• Main shop – CAPTCHA module
• example.com – global forms
• Prestashop Turnstile – reCAPTCHA module

Hostname management: This section defines which domains are allowed to use this widget.

Click on the "Add Hostnames" button, then enter your website domain (hostname).

Example: example.com

If you have multiple environments, you can add them too:

• www.example.com
• shop.example.com

Important notes

You must enter the hostname without https:// or paths.

→ Correct: example.com

→ Incorrect: https://example.com or example.com/login

Cloudflare allows up to 10 hostnames per widget, which is more than enough for most users.

If you add no hostname, the widget may still work, but the best practice is to add the exact domain for security.

4.2. Widget Mode

This determines how Turnstile behaves for your users. You will see three choices:

Managed (Recommended)

Cloudflare automatically decides whether to:

• Show a simple checkbox, OR
• Complete verification silently without any interaction.

Why choose this?

• Best balance of user experience + security.
• No puzzles, no text, no image verification.
• Works smoothly with most e-commerce and form systems.

Recommended for 99% of use cases.

Non-interactive

This mode attempts to verify users without showing anything, except a small loading bar widget.

Use only if:

• You want a verification method that is still visible but does not require clicks.
• You want predictable behavior without auto-switching.

Not recommended for general users unless you have a specific need.

Invisible

This mode performs verification completely in the background, without showing the user a widget unless something suspicious is detected.

Good for:

• Very clean UI where you do not want CAPTCHA elements visible.
• Situations where you want the smoothest user flow.

Note: Some merchants prefer Managed over Invisible because Managed is more reliable across different browsers.

4.3. Pre-clearance Setting

Pre-clearance allows Turnstile to issue a clearance cookie before your visitor reaches forms protected by Turnstile.

Options:

• No (recommended for most users)

The widget will validate the user each time the form loads. This is simpler and avoids dependency on other Cloudflare settings.

• Yes

Useful only if your website is proxied through Cloudflare AND you want visitors who already passed a Turnstile check to skip future challenges automatically.

5. Final Step: Create

After you fill out all fields, click "Create".

Cloudflare will instantly generate:

• Site key
• Secret key

These are the values you will copy into your CAPTCHA – reCAPTCHA module.